{
 "id": "WPSEC-2026-2172",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2172/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2172/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2172/index.md",
 "title": "Keep Backup Daily <= 2.1.4 - Cross-Site Request Forgery to Backup Deletion",
 "description": "The Keep Backup Daily plugin for WordPress is vulnerable to Cross-Site Request Forgery via the backup download page (kbd_force_download function) in all versions up to, and including, 2.1.4, due to missing nonce validation on the 'file' and 'rm' GET parameters. This makes it possible for unauthenticated attackers to delete database backups, or other .gz files in the root of the uploads directory, whose names they know, via a forged request, provided they can trick a site administrator into performing an action such as clicking a link.",
 "plugin": {
  "slug": "keep-backup-daily",
  "name": "Keep Backup Daily",
  "full_name": "Keep Backup Daily",
  "wordpress_org": "https://wordpress.org/plugins/keep-backup-daily/",
  "advisories_url": "https://wpsec.com/vuln/plugin/keep-backup-daily/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/keep-backup-daily"
 },
 "type": "CSRF",
 "cwe": [
  "CWE-352"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.2.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.2.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.2.0",
 "remediation": "Update to 2.2.0 or later.",
 "fix_released": "2026-10-30T06:12:38+00:00",
 "published": "2026-10-31T06:40:41+00:00",
 "updated": "2026-10-30T09:33:04.285605+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2172/",
  "https://plugins.svn.wordpress.org/keep-backup-daily/tags/2.2.0/",
  "https://wordpress.org/plugins/keep-backup-daily/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/keep-backup-daily",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-31"
 }
}